Question
Your on-premises network contains an Active Directory domain named contoso.com. You have an Azure AD tenant.
You plan to sync contoso.com with the Azure AD tenant by using Azure AD Connect cloud sync.
You need to create an account that will be used by Azure AD Connect cloud sync.
Which type of account should you create?
- A. system-assigned managed identity
- B. group managed service account (gMSA) Correct
- C. user
- D. InetOrgPerson
Explanation
Azure AD Connect cloud sync (now Microsoft Entra Cloud Sync) runs its provisioning agent under a group managed service account (gMSA). During agent setup you supply Domain Administrator or Enterprise Administrator credentials so the installer can create the gMSA, which appears as domain\provAgentgMSA$; you can also create a custom gMSA with the required permissions. A gMSA gives automatic password management and can be used across multiple agent servers. A regular user account or an InetOrgPerson object is not the account the agent service runs as, and a system-assigned managed identity is an Azure resource identity, not an on-premises AD account.
